You open your laptop in a hotel room or conference hall, click the Wi-Fi icon, and a browser window pops up asking you to log in or accept terms before you get online. Most of the time this is completely normal — it's called a captive portal, and hotels, airports, and conference centers use them to gate access to their network. But that same login page is also a nearly perfect disguise for an attacker, because you expect to see one, you're in a hurry, and you have no way to independently verify who actually built the page you're looking at.

Researchers at Microsoft recently disclosed a campaign, tracked as "CaptiveCrunch," in which attackers positioned themselves inside hotel and conference Wi-Fi networks and manipulated the traffic travelers saw during that exact moment — redirecting captive-portal sessions to fake login pages (including convincing fake Microsoft sign-in screens) designed to harvest passwords, device codes, and OAuth tokens, or to pop fake "update required" dialogs that install remote-access malware capable of reading keystrokes and activating a webcam or microphone. The point isn't that every hotel Wi-Fi login is a trap — the vast majority aren't. The point is that this specific moment, when you're expected to type something into an unfamiliar page before you're even online, is a soft target, and it's worth having a routine for it.

Why this moment is different from normal phishing

Ordinary phishing training tells you to check the sender, hover over links, look for a padlock. Captive portals break most of those habits. You didn't navigate to the page — your device was redirected there automatically. There's no "From:" address to check. The page often loads without a normal address bar visible (some operating systems open it in a stripped-down browser window), and you may be on a network you don't control and can't verify, so even a correct-looking HTTPS padlock only tells you the connection to that page is encrypted — not that the page itself is legitimate or that the network isn't manipulating what you see.

What a legitimate captive portal should — and shouldn't — ask for

Use this as your baseline filter every time one of these pages appears:

  • Normal: your last name and room number, a conference badge or registration code, agreeing to terms of service, an email address for a receipt, or a one-time code sent via text to verify you're a paying guest.
  • Not normal: a request to sign in with your Microsoft, Google, Apple, or corporate identity account. A real venue Wi-Fi system has no legitimate reason to need your Microsoft password to grant you internet access.
  • Not normal: a prompt to enter a "device code" shown to you elsewhere, or a page that says something like "go to microsoft.com/devicelogin and enter this code." This is a real Microsoft feature (used for signing into devices like smart TVs) that attackers abuse specifically because it lets them hijack your account without ever seeing your password. If a Wi-Fi login page is walking you through a device-code flow, stop — close the browser and don't proceed.
  • Not normal: any pop-up telling you your browser or Windows needs an urgent update, especially one that asks you to copy a command and paste it into a "Run" box or terminal to "fix" the connection. This pattern (sometimes called ClickFix) is a common way to trick people into installing malware themselves, and no legitimate Wi-Fi portal ever needs you to run a command.

Step-by-step: connecting safely

  1. Before you travel, turn off auto-join for open networks. On your phone: Settings → Wi-Fi → turn off "Auto-Join" or "Auto-Connect" for open/unsecured networks (exact wording varies by device). This stops your device from silently reconnecting to a similarly-named rogue network later without you noticing.
  2. Forget old public networks you no longer use. If your laptop or phone has "Airport_Free_WiFi" or an old hotel network saved, delete it. Attackers can broadcast a network with the same name (an "evil twin") and your device may connect to it automatically because it recognizes the name.
  3. When you join the real network, mark it as public/untrusted. Windows and macOS both ask whether a new network is a "public" or "private"/"trusted" network — choose public. This disables file sharing and network discovery, limiting what else on that network can see or reach your device.
  4. Read the portal page before you type anything. Check it against the "normal vs. not normal" list above. If it asks for an identity-provider login, a device code, or wants you to run a command, close the tab, and instead ask the front desk or registration table for the correct network name and password by name — don't trust a page to tell you what the network is called.
  5. Only enter the minimum the portal needs — usually a room number, last name, or a code you were physically handed. Never enter your email password or an account you use elsewhere.
  6. Once you're through the portal, turn on a VPN before doing anything else. This is the single most effective step, because it means that even if the network itself is hostile, everything after this point is encrypted in a tunnel the network operator (or an attacker on it) can't read or redirect. Do this before checking email, logging into anything, or opening banking apps.
  7. If you don't have a VPN, save sensitive logins for later or use your phone's cellular data instead. Turning your phone into a personal hotspot and connecting your laptop to that, even briefly, avoids the venue network entirely for anything sensitive — banking, work email, password manager unlocks.
  8. When you leave, forget the network (on both phone and laptop) rather than letting it sit in your saved-networks list indefinitely.

If you think you already fell for one

If you entered a Microsoft, Google, or other account password into a Wi-Fi login page, or completed a device-code prompt you didn't initiate yourself, treat the account as compromised: change that password immediately from a trusted network or device, check the account's recent sign-in activity and connected devices/sessions and sign out anything you don't recognize, and review connected apps or "apps with access to your account" for anything you didn't authorize — device-code phishing specifically grants an attacker a token without ever needing your password, so a password change alone may not remove their access. If you clicked through an "update now" or ran a command from a pop-up, disconnect that device from the internet and treat it as potentially infected until it's been scanned or rebuilt, since the payloads described in this kind of campaign have included tools capable of logging keystrokes and activating your webcam or microphone.

The takeaway

A captive portal isn't inherently suspicious — it's a normal, boring part of travel. What changes the risk is what it asks you to do. A page that wants your room number is doing its job. A page that wants your Microsoft password, a device code, or a command pasted into a terminal is not a Wi-Fi login screen anymore — it's a phishing page wearing one as a costume. Knowing the difference, and reaching for a VPN or your phone's hotspot for anything sensitive, closes off the exact moment this kind of attack depends on.